Electronic vs digital signature

Electronic signature: the legal idea

US law defines an electronic signature as "an electronic sound, symbol, or process" attached to or logically associated with a record and adopted by a person with the intent to sign it. The ESIGN Act and UETA use nearly the same words. That covers a lot:

• a signature drawn with a finger or mouse;
• a typed name in a signature field;
• a picture of a handwritten signature placed on a document;
• a click on a button that says you agree and are signing.

The definition says nothing about technology, certificates or encryption. What matters is intent. Because of that, an electronic signature is only as strong as the evidence around it: who received the document, how they got in, whether they agreed to sign electronically, and when each step happened.

Digital signature: the cryptographic one

A digital signature is built on public key infrastructure (PKI). In plain English:

1. 1

   A certificate ties a key to a person

   The signer gets a certificate, usually from a certificate authority or their organization, that links them to a private key only they control.

2. 2

   The document is fingerprinted

   Software computes a hash of the file: a short string that changes completely if even one character of the file changes.

3. 3

   The fingerprint is signed

   The hash is signed with the signer's private key and embedded in the file along with the certificate.

4. 4

   Anyone can check it

   A PDF reader uses the public key in the certificate to confirm the signature matches the file. If the file was edited afterward, the check fails.

Side by side

A digital signature can be one way to make an electronic signature. Not every electronic signature is a digital signature.

Which one does the law require?

In the US, neither ESIGN nor UETA requires certificates. Both define an e-signature by intent, not by technology, so a well-documented electronic signature works for most business agreements. When someone needs a certificate-based signature, it's usually because a specific agency, court or contract asks for one, and they'll tell you.

The European Union is different. Its eIDAS Regulation sets three levels: simple, advanced and qualified electronic signatures. An advanced signature must be uniquely linked to and able to identify the signer, and any later change to the data must be detectable. Only a qualified electronic signature, made with a qualified certificate and device, automatically has the same legal effect as a handwritten signature.

How to tell which kind a PDF has

Open the signed PDF in a reader that checks signatures, such as Adobe Acrobat Reader or Microsoft Edge, which can view and validate certificate-based signatures. A digital signature shows up as a signature the reader can verify, with the signer's certificate details and whether the file has changed since. An electronic signature without a certificate is part of the page itself. It looks the same printed, but the reader has nothing to verify, so its proof lives in the record that came with it, like a certificate of completion.

Some files carry both: a drawn signature on the page for people to see, and a certificate-based signature underneath for software to check.

What SignMaster applies

SignMaster creates electronic signatures. It does not add a certificate-based (PKI) digital signature to the finished PDF, and it doesn't offer EU qualified signatures. Instead, it records the evidence around each signature and fingerprints the files:

• When you send, SignMaster records a SHA-256 fingerprint of each original file. Before the signed PDF is built, every file is checked against it, and a mismatch stops the process.
• The finished PDF gets its own SHA-256 fingerprint, saved with the envelope.
• Every page carries the envelope ID and a page count in the margin.
• The certificate of completion lists each signer's name, email, IP address, device, and when they viewed, consented and signed, along with the original files' fingerprints.
• Each signer agrees to use electronic records and signatures before signing, and can decline.

An envelope is SignMaster's word for one or more documents going to one or more signers. If a recipient asks for a certificate-based signature or an EU qualified signature, use a provider that issues them. For everyday contracts, SignMaster's record is built to show who signed what, and when. Read more on our security page.